Splunk Search

Inconsistent Count result

kcchu01
Explorer

Original Search

sourcetype=xxx | dedup user | timechart span=1d count(user)

I found that the results are different for selecting the different time ranges

Time Range _time count(user)
All time : 2019-10-20 269
during Oct 20: 2019-10-20 1473

Why I got different results by selecting different time ranges?

Thank you

Tags (1)
0 Karma

wmyersas
Builder

Part of the issue with this search is you're using dedup in your original search ( sourcetype=xxx | dedup user | timechart span=1d count(user) )

A better search is this:

index=ndx sourcetype=srctp user=*
| timechart span=1d dc(user)

This will give you a distinct count of the user field per day using the much simpler (and faster) dc() ( distinct_count() ) stats function - https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Aggregatefunctions#distinct_count...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kcchu01,
dedup has a limit of 10,000 results, if you want to exceed this limit you have to insert 0 in dedup command.
Something like this:

sourcetype=xxx 
| dedup 0 user 
| timechart span=1d count(user)

P.S.: It's better to always use index in main search to have more performant searches.

Ciao.
Giuseppe

0 Karma

wmyersas
Builder

It's also better to use stats vs dedup

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...